Skip to content
API Reference

Admin

Configure and operate identity, policy, and access controls for your Keycard deployment.

Admin is where teams configure and operate Keycard: identity, resource catalogs, access policy, roles, SSO, audit, deployment, and billing. It turns agent access from an ad hoc approval process into rules that enforce themselves.

With Admin, you can:

  • Write permit/forbid policies that evaluate every request, with safe rollback to any previous version
  • Bring your own IdP so users authenticate through Okta, Auth0, or Google
  • Assign Admin or Viewer roles to your team, and grant zone-level access
  • Install MCP servers and OAuth-protected APIs from the Catalog, all governed by your identity and policy layer
  • Gate administrative access behind your corporate SSO

Get Started

Section titled “Get Started”
GET STARTED

Set up your identity provider, from app creation to first login.

Use Okta for Sign InCreate an Okta application and configure it as a provider in Keycard
Use Microsoft Entra ID for Sign InCreate a Microsoft Entra ID app registration and configure it as a provider in Keycard
Use Ping Identity for Sign InCreate a PingOne application or PingFederate client and configure it as a provider in Keycard
Use Auth0 for Sign InCreate an Auth0 application and configure it as a provider in Keycard

Configuration

Section titled “Configuration”
CONFIGURATION

Each admin area with setup steps and examples.

Custom ZonesCreate a custom Zone with its own users, admin access, and Identity Provider
Access PoliciesIndividual permit/forbid rules and policy sets that control access
Identity ProvidersConnect your own OAuth 2.0 IdP for zone-level user authentication
Configure Zone sign-inChoose the Identity Provider people use to sign in to a custom Zone
GroupsCollect Users into Groups that carry inherited Roles and can be granted access by policy
Roles & PermissionsOrganization and zone roles that control who can manage Keycard
Single Sign-OnOIDC-based SSO for your team’s access to Keycard Console, with JIT or SCIM provisioning
CatalogOne-click installs for popular MCP servers and OAuth-protected APIs - Gmail, GitHub, Slack, Notion, Stripe, and more
Unified Access GatewayExpose multiple MCP servers through a single, policy-governed endpoint
Service AccountsCredentials for Terraform, pipelines, and scripts that call the management API
Audit Log ExportExport audit events to your S3 bucket as OCSF Parquet files for your SIEM
DeploymentKeycard Cloud and Dedicated Enterprise Cloud, and how to move between them
Usage & BillingWhat counts as a transaction against your plan, and how to estimate usage
Terraform